The Agent Skills Directory

[COMMAND_EXECUTION] (MEDIUM): The TypeScript wrapper module_architect_wrapper.ts executes PowerShell scripts using spawn with the -ExecutionPolicy RemoteSigned flag. This explicitly bypasses local security restrictions designed to prevent the execution of unsigned scripts.
[COMMAND_EXECUTION] (LOW): The executePowerShell function in the TS wrapper constructs command arguments from user-controlled object keys and values. While using spawn mitigates shell injection, the lack of a strict allowlist for parameter names allows for parameter injection (e.g., passing unexpected flags to the PowerShell executable).
[DYNAMIC_EXECUTION] (MEDIUM): The REFERENCE.md file includes a pattern for 'Assembly Caching' that utilizes Add-Type to compile C# source code into a DLL at runtime. This allows for the execution of arbitrary compiled code if the source directory is compromised.
[EXTERNAL_DOWNLOADS] (LOW): Documentation in best_practices.md recommends the use of Install-Module for PSScriptAnalyzer. This facilitates the download and execution of code from the PowerShell Gallery, an external repository where packages are not implicitly trusted.
[INDIRECT_PROMPT_INJECTION] (LOW): The skill possesses a significant attack surface for indirect injection.
Ingestion points: analyzeModule and getDirectoryStructure read file and directory names from the local file system.
Boundary markers: None identified in the provided templates.
Capability inventory: The skill can execute PowerShell scripts, compile code, and write files to the disk (createDocumentation).
Sanitization: Input parameters are converted to strings but are not validated against a rigid schema or sanitized before being passed to the PowerShell execution environment.

powershell-module-architect